Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 17:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f87173c4e311062c42855c09d935a60a79ed4544b819d1815b4acb4913455011N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
f87173c4e311062c42855c09d935a60a79ed4544b819d1815b4acb4913455011N.exe
-
Size
454KB
-
MD5
e96aa6274dd1fcd9779b1c46a0165d60
-
SHA1
24cf6e4628b0aee9a3fb9740d37c0a2db68a738f
-
SHA256
f87173c4e311062c42855c09d935a60a79ed4544b819d1815b4acb4913455011
-
SHA512
c114f20298b494d9bb338b44ea8fd84f659346b6d7ea02f4695b9e404c0283ed57ff4a6b3134fb7fcfa7d10205f6013cb6867e02b59eab10f4d787245d1af4e0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT:q7Tc2NYHUrAwfMp3CDT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5012-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2116-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2668-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1184-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/840-852-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-865-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-908-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-1307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-3080-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3904 lflfrrr.exe 2116 tnnnhh.exe 3876 tnhtbb.exe 1444 bhbhbh.exe 3572 pvvpp.exe 3500 jvjdj.exe 4900 jvjdv.exe 3840 nhbnhb.exe 5116 vppjd.exe 1736 tnthbt.exe 3328 5thhhh.exe 2016 nnbttt.exe 3816 bntnhh.exe 2264 lffxrrr.exe 2660 pdppv.exe 2784 hbhnbn.exe 3628 vddvp.exe 4540 nhhthh.exe 3652 3dddp.exe 2216 pjjdd.exe 3504 xlrfrlx.exe 1072 nhnhtt.exe 232 jppjv.exe 1324 bbtnnh.exe 724 vjvpj.exe 3944 vjjdv.exe 932 5nhbth.exe 3196 bbbtnh.exe 4448 frfxrll.exe 3160 3ppjv.exe 1868 nbhtnh.exe 2684 rrffxfl.exe 2668 vjpjj.exe 4604 fxffffx.exe 3364 rxllrrl.exe 4304 7dddv.exe 3048 xxlxllx.exe 2404 5nnnhn.exe 3456 dvdvp.exe 4612 rrfxxff.exe 840 xllfxxl.exe 3984 bhnhtn.exe 4364 pdjdv.exe 1440 jdppp.exe 3572 ffffxxr.exe 3092 nbbttt.exe 4984 dvddv.exe 1156 frxxllr.exe 3980 lrrlxrl.exe 3204 7hhhhn.exe 5116 dpvvv.exe 2504 lffxlfx.exe 2436 bbhnht.exe 4856 vpdjd.exe 316 vpdvp.exe 3404 7ttnhh.exe 2976 nhbtnh.exe 3592 1pvdv.exe 2448 9rxxffl.exe 2640 tbtbhn.exe 812 3pvvj.exe 1548 jdddd.exe 548 xllxfxr.exe 1760 hhtnhb.exe -
resource yara_rule behavioral2/memory/5012-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2668-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2504-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/840-852-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-865-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5012 wrote to memory of 3904 5012 f87173c4e311062c42855c09d935a60a79ed4544b819d1815b4acb4913455011N.exe 82 PID 5012 wrote to memory of 3904 5012 f87173c4e311062c42855c09d935a60a79ed4544b819d1815b4acb4913455011N.exe 82 PID 5012 wrote to memory of 3904 5012 f87173c4e311062c42855c09d935a60a79ed4544b819d1815b4acb4913455011N.exe 82 PID 3904 wrote to memory of 2116 3904 lflfrrr.exe 83 PID 3904 wrote to memory of 2116 3904 lflfrrr.exe 83 PID 3904 wrote to memory of 2116 3904 lflfrrr.exe 83 PID 2116 wrote to memory of 3876 2116 tnnnhh.exe 84 PID 2116 wrote to memory of 3876 2116 tnnnhh.exe 84 PID 2116 wrote to memory of 3876 2116 tnnnhh.exe 84 PID 3876 wrote to memory of 1444 3876 tnhtbb.exe 85 PID 3876 wrote to memory of 1444 3876 tnhtbb.exe 85 PID 3876 wrote to memory of 1444 3876 tnhtbb.exe 85 PID 1444 wrote to memory of 3572 1444 bhbhbh.exe 86 PID 1444 wrote to memory of 3572 1444 bhbhbh.exe 86 PID 1444 wrote to memory of 3572 1444 bhbhbh.exe 86 PID 3572 wrote to memory of 3500 3572 pvvpp.exe 87 PID 3572 wrote to memory of 3500 3572 pvvpp.exe 87 PID 3572 wrote to memory of 3500 3572 pvvpp.exe 87 PID 3500 wrote to memory of 4900 3500 jvjdj.exe 88 PID 3500 wrote to memory of 4900 3500 jvjdj.exe 88 PID 3500 wrote to memory of 4900 3500 jvjdj.exe 88 PID 4900 wrote to memory of 3840 4900 jvjdv.exe 89 PID 4900 wrote to memory of 3840 4900 jvjdv.exe 89 PID 4900 wrote to memory of 3840 4900 jvjdv.exe 89 PID 3840 wrote to memory of 5116 3840 nhbnhb.exe 90 PID 3840 wrote to memory of 5116 3840 nhbnhb.exe 90 PID 3840 wrote to memory of 5116 3840 nhbnhb.exe 90 PID 5116 wrote to memory of 1736 5116 vppjd.exe 91 PID 5116 wrote to memory of 1736 5116 vppjd.exe 91 PID 5116 wrote to memory of 1736 5116 vppjd.exe 91 PID 1736 wrote to memory of 3328 1736 tnthbt.exe 92 PID 1736 wrote to memory of 3328 1736 tnthbt.exe 92 PID 1736 wrote to memory of 3328 1736 tnthbt.exe 92 PID 3328 wrote to memory of 2016 3328 5thhhh.exe 93 PID 3328 wrote to memory of 2016 3328 5thhhh.exe 93 PID 3328 wrote to memory of 2016 3328 5thhhh.exe 93 PID 2016 wrote to memory of 3816 2016 nnbttt.exe 94 PID 2016 wrote to memory of 3816 2016 nnbttt.exe 94 PID 2016 wrote to memory of 3816 2016 nnbttt.exe 94 PID 3816 wrote to memory of 2264 3816 bntnhh.exe 95 PID 3816 wrote to memory of 2264 3816 bntnhh.exe 95 PID 3816 wrote to memory of 2264 3816 bntnhh.exe 95 PID 2264 wrote to memory of 2660 2264 lffxrrr.exe 96 PID 2264 wrote to memory of 2660 2264 lffxrrr.exe 96 PID 2264 wrote to memory of 2660 2264 lffxrrr.exe 96 PID 2660 wrote to memory of 2784 2660 pdppv.exe 97 PID 2660 wrote to memory of 2784 2660 pdppv.exe 97 PID 2660 wrote to memory of 2784 2660 pdppv.exe 97 PID 2784 wrote to memory of 3628 2784 hbhnbn.exe 98 PID 2784 wrote to memory of 3628 2784 hbhnbn.exe 98 PID 2784 wrote to memory of 3628 2784 hbhnbn.exe 98 PID 3628 wrote to memory of 4540 3628 vddvp.exe 99 PID 3628 wrote to memory of 4540 3628 vddvp.exe 99 PID 3628 wrote to memory of 4540 3628 vddvp.exe 99 PID 4540 wrote to memory of 3652 4540 nhhthh.exe 100 PID 4540 wrote to memory of 3652 4540 nhhthh.exe 100 PID 4540 wrote to memory of 3652 4540 nhhthh.exe 100 PID 3652 wrote to memory of 2216 3652 3dddp.exe 101 PID 3652 wrote to memory of 2216 3652 3dddp.exe 101 PID 3652 wrote to memory of 2216 3652 3dddp.exe 101 PID 2216 wrote to memory of 3504 2216 pjjdd.exe 102 PID 2216 wrote to memory of 3504 2216 pjjdd.exe 102 PID 2216 wrote to memory of 3504 2216 pjjdd.exe 102 PID 3504 wrote to memory of 1072 3504 xlrfrlx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\f87173c4e311062c42855c09d935a60a79ed4544b819d1815b4acb4913455011N.exe"C:\Users\Admin\AppData\Local\Temp\f87173c4e311062c42855c09d935a60a79ed4544b819d1815b4acb4913455011N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\lflfrrr.exec:\lflfrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\tnnnhh.exec:\tnnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\tnhtbb.exec:\tnhtbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\bhbhbh.exec:\bhbhbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\pvvpp.exec:\pvvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\jvjdj.exec:\jvjdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\jvjdv.exec:\jvjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\nhbnhb.exec:\nhbnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\vppjd.exec:\vppjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\tnthbt.exec:\tnthbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\5thhhh.exec:\5thhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\nnbttt.exec:\nnbttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\bntnhh.exec:\bntnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\lffxrrr.exec:\lffxrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\pdppv.exec:\pdppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\hbhnbn.exec:\hbhnbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\vddvp.exec:\vddvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\nhhthh.exec:\nhhthh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\3dddp.exec:\3dddp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\pjjdd.exec:\pjjdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\xlrfrlx.exec:\xlrfrlx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\nhnhtt.exec:\nhnhtt.exe23⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jppjv.exec:\jppjv.exe24⤵
- Executes dropped EXE
PID:232 -
\??\c:\bbtnnh.exec:\bbtnnh.exe25⤵
- Executes dropped EXE
PID:1324 -
\??\c:\vjvpj.exec:\vjvpj.exe26⤵
- Executes dropped EXE
PID:724 -
\??\c:\vjjdv.exec:\vjjdv.exe27⤵
- Executes dropped EXE
PID:3944 -
\??\c:\5nhbth.exec:\5nhbth.exe28⤵
- Executes dropped EXE
PID:932 -
\??\c:\bbbtnh.exec:\bbbtnh.exe29⤵
- Executes dropped EXE
PID:3196 -
\??\c:\frfxrll.exec:\frfxrll.exe30⤵
- Executes dropped EXE
PID:4448 -
\??\c:\3ppjv.exec:\3ppjv.exe31⤵
- Executes dropped EXE
PID:3160 -
\??\c:\nbhtnh.exec:\nbhtnh.exe32⤵
- Executes dropped EXE
PID:1868 -
\??\c:\rrffxfl.exec:\rrffxfl.exe33⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vjpjj.exec:\vjpjj.exe34⤵
- Executes dropped EXE
PID:2668 -
\??\c:\fxffffx.exec:\fxffffx.exe35⤵
- Executes dropped EXE
PID:4604 -
\??\c:\rxllrrl.exec:\rxllrrl.exe36⤵
- Executes dropped EXE
PID:3364 -
\??\c:\7dddv.exec:\7dddv.exe37⤵
- Executes dropped EXE
PID:4304 -
\??\c:\xxlxllx.exec:\xxlxllx.exe38⤵
- Executes dropped EXE
PID:3048 -
\??\c:\5nnnhn.exec:\5nnnhn.exe39⤵
- Executes dropped EXE
PID:2404 -
\??\c:\dvdvp.exec:\dvdvp.exe40⤵
- Executes dropped EXE
PID:3456 -
\??\c:\rrfxxff.exec:\rrfxxff.exe41⤵
- Executes dropped EXE
PID:4612 -
\??\c:\xllfxxl.exec:\xllfxxl.exe42⤵
- Executes dropped EXE
PID:840 -
\??\c:\bhnhtn.exec:\bhnhtn.exe43⤵
- Executes dropped EXE
PID:3984 -
\??\c:\pdjdv.exec:\pdjdv.exe44⤵
- Executes dropped EXE
PID:4364 -
\??\c:\jdppp.exec:\jdppp.exe45⤵
- Executes dropped EXE
PID:1440 -
\??\c:\ffffxxr.exec:\ffffxxr.exe46⤵
- Executes dropped EXE
PID:3572 -
\??\c:\nbbttt.exec:\nbbttt.exe47⤵
- Executes dropped EXE
PID:3092 -
\??\c:\dvddv.exec:\dvddv.exe48⤵
- Executes dropped EXE
PID:4984 -
\??\c:\frxxllr.exec:\frxxllr.exe49⤵
- Executes dropped EXE
PID:1156 -
\??\c:\lrrlxrl.exec:\lrrlxrl.exe50⤵
- Executes dropped EXE
PID:3980 -
\??\c:\7hhhhn.exec:\7hhhhn.exe51⤵
- Executes dropped EXE
PID:3204 -
\??\c:\dpvvv.exec:\dpvvv.exe52⤵
- Executes dropped EXE
PID:5116 -
\??\c:\lffxlfx.exec:\lffxlfx.exe53⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bbhnht.exec:\bbhnht.exe54⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vpdjd.exec:\vpdjd.exe55⤵
- Executes dropped EXE
PID:4856 -
\??\c:\vpdvp.exec:\vpdvp.exe56⤵
- Executes dropped EXE
PID:316 -
\??\c:\7ttnhh.exec:\7ttnhh.exe57⤵
- Executes dropped EXE
PID:3404 -
\??\c:\nhbtnh.exec:\nhbtnh.exe58⤵
- Executes dropped EXE
PID:2976 -
\??\c:\1pvdv.exec:\1pvdv.exe59⤵
- Executes dropped EXE
PID:3592 -
\??\c:\9rxxffl.exec:\9rxxffl.exe60⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tbtbhn.exec:\tbtbhn.exe61⤵
- Executes dropped EXE
PID:2640 -
\??\c:\3pvvj.exec:\3pvvj.exe62⤵
- Executes dropped EXE
PID:812 -
\??\c:\jdddd.exec:\jdddd.exe63⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xllxfxr.exec:\xllxfxr.exe64⤵
- Executes dropped EXE
PID:548 -
\??\c:\hhtnhb.exec:\hhtnhb.exe65⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pvvpd.exec:\pvvpd.exe66⤵PID:2540
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe67⤵PID:1884
-
\??\c:\7hnnhh.exec:\7hnnhh.exe68⤵PID:4792
-
\??\c:\hbttbb.exec:\hbttbb.exe69⤵PID:220
-
\??\c:\jppjd.exec:\jppjd.exe70⤵PID:2104
-
\??\c:\ffxlfxl.exec:\ffxlfxl.exe71⤵PID:3504
-
\??\c:\nbhbtb.exec:\nbhbtb.exe72⤵PID:4920
-
\??\c:\ttnbtn.exec:\ttnbtn.exe73⤵PID:720
-
\??\c:\vdjdp.exec:\vdjdp.exe74⤵PID:3108
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe75⤵PID:232
-
\??\c:\ttnhhh.exec:\ttnhhh.exe76⤵PID:3172
-
\??\c:\jvdvp.exec:\jvdvp.exe77⤵PID:1236
-
\??\c:\lflxlff.exec:\lflxlff.exe78⤵PID:1644
-
\??\c:\xxrxrxr.exec:\xxrxrxr.exe79⤵PID:724
-
\??\c:\nnntnb.exec:\nnntnb.exe80⤵PID:4012
-
\??\c:\5vddd.exec:\5vddd.exe81⤵
- System Location Discovery: System Language Discovery
PID:3528 -
\??\c:\flxrrlf.exec:\flxrrlf.exe82⤵PID:2828
-
\??\c:\xrrflff.exec:\xrrflff.exe83⤵PID:4184
-
\??\c:\nbnhhh.exec:\nbnhhh.exe84⤵PID:2064
-
\??\c:\dpvpd.exec:\dpvpd.exe85⤵PID:740
-
\??\c:\lrrlxlr.exec:\lrrlxlr.exe86⤵PID:1184
-
\??\c:\5xllffx.exec:\5xllffx.exe87⤵PID:3556
-
\??\c:\5hnnhh.exec:\5hnnhh.exe88⤵PID:400
-
\??\c:\9jjdp.exec:\9jjdp.exe89⤵PID:3372
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe90⤵PID:1388
-
\??\c:\ttbnhh.exec:\ttbnhh.exe91⤵PID:3124
-
\??\c:\dpdpj.exec:\dpdpj.exe92⤵PID:1252
-
\??\c:\ddjdd.exec:\ddjdd.exe93⤵PID:1096
-
\??\c:\1xrlrrl.exec:\1xrlrrl.exe94⤵PID:4212
-
\??\c:\hhtnnn.exec:\hhtnnn.exe95⤵PID:3408
-
\??\c:\pvdvp.exec:\pvdvp.exe96⤵PID:3136
-
\??\c:\7xrlxxr.exec:\7xrlxxr.exe97⤵PID:2796
-
\??\c:\5lfrllf.exec:\5lfrllf.exe98⤵PID:632
-
\??\c:\bthhbn.exec:\bthhbn.exe99⤵PID:3184
-
\??\c:\vvvvv.exec:\vvvvv.exe100⤵PID:2968
-
\??\c:\rrlxllr.exec:\rrlxllr.exe101⤵PID:4280
-
\??\c:\bhhhbh.exec:\bhhhbh.exe102⤵PID:3152
-
\??\c:\djppp.exec:\djppp.exe103⤵PID:3156
-
\??\c:\rxxxrxx.exec:\rxxxrxx.exe104⤵PID:2188
-
\??\c:\xrfffll.exec:\xrfffll.exe105⤵PID:2368
-
\??\c:\nntnnn.exec:\nntnnn.exe106⤵PID:1616
-
\??\c:\jjpvd.exec:\jjpvd.exe107⤵PID:3864
-
\??\c:\lxlfrrf.exec:\lxlfrrf.exe108⤵PID:4616
-
\??\c:\hhbbbt.exec:\hhbbbt.exe109⤵PID:4700
-
\??\c:\vvdpp.exec:\vvdpp.exe110⤵PID:2924
-
\??\c:\pvvdd.exec:\pvvdd.exe111⤵PID:4720
-
\??\c:\lfrflll.exec:\lfrflll.exe112⤵PID:2040
-
\??\c:\nnnhbh.exec:\nnnhbh.exe113⤵PID:4900
-
\??\c:\vjpjd.exec:\vjpjd.exe114⤵PID:3840
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe115⤵PID:3928
-
\??\c:\1nnbtn.exec:\1nnbtn.exe116⤵PID:2824
-
\??\c:\5vdvv.exec:\5vdvv.exe117⤵PID:2792
-
\??\c:\vjvvp.exec:\vjvvp.exe118⤵PID:1276
-
\??\c:\xflfxxx.exec:\xflfxxx.exe119⤵PID:4712
-
\??\c:\nnbnhh.exec:\nnbnhh.exe120⤵PID:324
-
\??\c:\bbhhnb.exec:\bbhhnb.exe121⤵PID:948
-
\??\c:\9pvjd.exec:\9pvjd.exe122⤵PID:1160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-